Roll libxslt to ac341cbd792ee572941cc9a66e73800219a1a386

third_party/libxslt/libexslt/functions.c

 #define IN_LIBEXSLT
 #include "libexslt/libexslt.h"
 
 #if defined(WIN32) && !defined (__CYGWIN__) && (!__MINGW32__)
 #include <win32config.h>
 #else
 #include "config.h"
 #endif
 
 #include <string.h>
@@ skipping 314 matching lines @@
     else
         paramNode = NULL;
     if ((paramNode == NULL) && (func->nargs != 0)) {
         xsltGenericError(xsltGenericErrorContext,
                          "exsltFuncFunctionFunction: nargs != 0 and "
                          "param == NULL\n");
         return;
     }
 
     /*
+    * When a function is called recursively during evaluation of its
+    * arguments, the recursion check in xsltApplySequenceConstructor
+    * isn't reached.
+    */
+    if (tctxt->depth >= tctxt->maxTemplateDepth) {
+        xsltTransformError(tctxt, NULL, NULL,
+            "exsltFuncFunctionFunction: Potentially infinite recursion "
+            "detected in function {%s}%s.\n",
+            ctxt->context->functionURI, ctxt->context->function);
+        tctxt->state = XSLT_STATE_STOPPED;
+        return;
+    }
+    tctxt->depth++;
+
+    /*
      * We have a problem with the evaluation of function parameters.
      * The original library code did not evaluate XPath expressions until
      * the last moment.  After version 1.1.17 of the libxslt, the logic
      * of other parts of the library was changed, and the evaluation of
      * XPath expressions within parameters now takes place as soon as the
      * parameter is parsed/evaluated (xsltParseStylesheetCallerParam).
      * This means that the parameters need to be evaluated in lexical
      * order (since a variable is "in scope" as soon as it is declared).
      * However, on entry to this routine, the values (from the caller) are
      * in reverse order (held on the XPath context variable stack).  To
@@ skipping 61 matching lines @@
     tctxt->insert = fake;
     xsltApplyOneTemplate (tctxt, xmlXPathGetContextNode(ctxt),
                           func->content, NULL, NULL);
     xsltLocalVariablePop(tctxt, tctxt->varsBase, -2);
     tctxt->insert = oldInsert;
     tctxt->varsBase = oldBase;  /* restore original scope */
     if (params != NULL)
         xsltFreeStackElemList(params);
 
     if (data->error != 0)
-        return;
+        goto error;
 
     if (data->result != NULL) {
         ret = data->result;
         /*
         * IMPORTANT: This enables previously tree fragments marked as
         * being results of a function, to be garbage-collected after
         * the calling process exits.
         */
         xsltFlagRVTs(tctxt, ret, XSLT_RVT_LOCAL);
     } else
         ret = xmlXPathNewCString("");
 
     data->result = oldResult;
 
     /*
      * It is an error if the instantiation of the template results in
      * the generation of result nodes.
      */
     if (fake->children != NULL) {
 #ifdef LIBXML_DEBUG_ENABLED
         xmlDebugDumpNode (stderr, fake, 1);
 #endif
         xsltGenericError(xsltGenericErrorContext,
                          "{%s}%s: cannot write to result tree while "
                          "executing a function\n",
                          ctxt->context->functionURI, ctxt->context->function);
         xmlFreeNode(fake);
-        return;
+        goto error;
     }
     xmlFreeNode(fake);
     valuePush(ctxt, ret);
+
+error:
+    tctxt->depth--;
 }
 
 
 static void
 exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
     xmlChar *name, *prefix;
     xmlNsPtr ns;
     xmlHashTablePtr data;
     exsltFuncFunctionData *func;
 
@@ skipping 310 matching lines @@
                        (xsltStyleExtShutdownFunction) exsltFuncStyleShutdown);
 
     xsltRegisterExtModuleTopLevel ((const xmlChar *) "function",
                                    EXSLT_FUNCTIONS_NAMESPACE,
                                    exsltFuncFunctionComp);
     xsltRegisterExtModuleElement ((const xmlChar *) "result",
                           EXSLT_FUNCTIONS_NAMESPACE,
                           (xsltPreComputeFunction)exsltFuncResultComp,
                           (xsltTransformFunction) exsltFuncResultElem);
 }